How to run not elevated program ?

[mLipok]

in some compiled script I use:

#RequireAdmin

This particular program have to run other exe file which normally should be easy by using:

ShellExecute() or Run()

But I need to run this External.exe as non elevated instance.

Anybody know how to do that ?

edit:
of course without using RunAs() as I do not want to provide login and password, I mean it should run on currently logged user credentials, just not in elevated mode.

 

Edited March 14, 2023 by mLipok

[mLipok]

As for now I found this:

https://stackoverflow.com/questions/37948064/how-to-launch-non-elevated-administrator-process-from-elevated-administrator-con

https://stackoverflow.com/questions/11169431/how-to-start-a-new-process-without-administrator-privileges-from-a-process-with?noredirect=1&lq=1

But it is out of my scope level.

[mistersquirrle]

Here's a thread that talked about the same issue as you are: 

The outcome was basically to have a script running that was admin, was not admin, and have each individually launch applications as you needed their specific permission level. 

There's also this topic linked, does this meet your needs? (Just kidding, unless someone has a copy, the site that the file/UDF was hosted on is no longer available).

Another option could possibly be to use the Task Scheduler, though that seems like a pretty involved method, and RunAs would likely be simpler, but either likely require password.

 

Edit: This may also be of interest, since it has a cmd option: https://superuser.com/questions/171917/force-a-program-to-run-without-administrator-privileges-or-uac

Edited March 15, 2023 by mistersquirrle

[jguinch]

There is a simple way using the "__COMPAT_LAYER" environment variable,  but it does not work with all programs.

Example here, if you want to run regedit without privileges : 

EnvSet("__COMPAT_LAYER", "RunAsInvoker")
Run("regedit.exe")

Run application without elevation ('Run As Administrator') (nirsoft.net)

 

[mLipok]

Thanks but this still not works.

I attach main.au3 and test.au3, to test what I mean just simply:
compile them both and run main.exe

You will see that test.exe msgbox shows IsAdmin() = 1

My intention is to get IsAdmin() = 0 but to be more specific by running main.exe

 

main.au3 test.au3

Edited March 27, 2023 by mLipok

[paw]

I have a copy of the code from

Posting this here because the original download link is no longer available.

_ShellExecuteWithReducedPrivileges.au3

[argumentum]

cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" "YourExe.exe"

I use this and works quite fine for me.

[mLipok]

22 minutes ago, argumentum said:

cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" "YourExe.exe"

I use this and works quite fine for me.

This will be fine if you run CMD with reduced privileges, but try to start CMD with Admin privileges .

[Gianni]

try this from Main.au3

ShellExecute("runas", "/trustlevel:0x20000 test.exe")

[mistersquirrle]

Just a little followup to @Giannis answer, 0x20000 is a "Basic User", and you can see what's available by running this in cmd:

runas /showtrustlevels

Here's some other examples of it: https://stackoverflow.com/questions/20218076/batch-file-drop-elevated-privileges-run-a-command-as-original-user

[mLipok]

On 3/27/2023 at 10:51 PM, mistersquirrle said:

Just a little followup to @Giannis answer, 0x20000 is a "Basic User", and you can see what's available by running this in cmd:

runas /showtrustlevels

Here's some other examples of it: https://stackoverflow.com/questions/20218076/batch-file-drop-elevated-privileges-run-a-command-as-original-user

I was trying to use this and I got this problem:

https://superuser.com/questions/1749696/parameter-is-incorrect-when-using-runas-with-trustlevel-after-windows-11-22h2

so I use:

Quote

runas /trustlevel:0x20000 /machine:x86 test.exe

and I get:

Quote

The image file c:\1\test.exe is valid, but it is for a different type of computer than the current one

and solution was to add directive to test.au3:

#AutoIt3Wrapper_UseX64=n
MsgBox(0, "testing:", 'IsAdmin() = ' & IsAdmin())

and the main.au3:

#RequireAdmin
Run('runas /trustlevel:0x20000 /machine:x86 test.exe')

 

Edited March 31, 2023 by mLipok

[mLipok]

on some computers I have hit an issue:

So I modified main.au3 to this form:

#RequireAdmin
#include <MsgBoxConstants.au3>

; https://superuser.com/a/1755207/1049106

_Example()
Func _Example()
    Local $s_EXE_Path = '"' & @ScriptDir & '\test.exe"'
    ConsoleWrite("! " & @CPUArch & @CRLF)
    ConsoleWrite("! " & @OSArch & @CRLF)
    ConsoleWrite("! " & @OSType & @CRLF)
    ConsoleWrite("! " & @OSVersion & @CRLF)
    ConsoleWrite("! " & @OSBuild & @CRLF)
    ConsoleWrite("! " & @OSVersion & @CRLF)
    ConsoleWrite("! " & @OSServicePack & @CRLF)

    ConsoleWrite($s_EXE_Path & @CRLF)

    MsgBox($MB_TOPMOST, "", 1)
    Local $iResult1 = Run('runas /trustlevel:0x20000 /machine:x86 ' & $s_EXE_Path, @ScriptDir, @SW_HIDE)
    ConsoleWrite("! $iResult1  = " & $iResult1 & @CRLF)

    MsgBox($MB_TOPMOST, "", 2)
    Local $iResult2 = Run('runas /trustlevel:0x20000 ' & $s_EXE_Path, @ScriptDir, @SW_HIDE)
    ConsoleWrite("! $iResult2  = " & $iResult2 & @CRLF)
    MsgBox($MB_TOPMOST, "", 3)

EndFunc   ;==>_Example

 

And I notice that some computers do not like /machine:x86 option

Edited April 5, 2023 by mLipok

[thezlehman]

Ran into this problem with a script. A workaround is to create a shortcut and launch that. 
 

If FileExists("C:\Program Files\Google\Chrome\Application\chrome.exe") Then FileCreateShortcut ("C:\Program Files\Google\Chrome\Application\chrome.exe",@DesktopDir &"\test.lnk","C:\Program Files\Google\Chrome\Application","http://example.com")

Run("explorer.exe "&@DesktopDir&"\test.lnk")

    

[rsn]

_RunWithReducedPrivileges does have a caveat: If you launch an app as a different user, any child processes run via _RunWithReducedPrivileges is launched by the logged in user instead of the user of the parent process.

 

When I run 

runas /trustlevel:0x20000 someapp.exe

from an elevated application and look in Task manager, the resulting process is says it's elevated. Unless there's something funky with my PC, the /trustlevel argument doesn't seem to work.

Edited April 5, 2023 by rsn

[mLipok]

On 4/5/2023 at 3:53 PM, rsn said:

the resulting process is says it's elevated.

Which windows ? 11 ? Which exact version ?

[rsn]

@mLipok I'm running Win 10 Enterprise 22H2 (10.0.19045.2728)